net: lapbether: handle NETDEV_PRE_TYPE_CHANGE

lapbeth_data_transmit() expects the underlying device type
to be ARPHRD_ETHER.

Returning NOTIFY_BAD from lapbeth_device_event() makes sure
bonding driver can not break this expectation.

Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER")
Reported-by: syzbot+d8c285748fa7292580a9@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/69cd22a1.050a0220.70c3a.0002.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Martin Schiller <ms@dev.tdt.de>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260402103519.1201565-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index f357a7ac70ac4756967730fa61c07258b4b3ac00..9861c99ea56c4efb03f22375b60f68665443e04d 100644 (file)
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -446,33 +446,36 @@ static void lapbeth_free_device(struct lapbethdev *lapbeth)
 static int lapbeth_device_event(struct notifier_block *this,
                                unsigned long event, void *ptr)
 {
-       struct lapbethdev *lapbeth;
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+       struct lapbethdev *lapbeth;
 
        if (dev_net(dev) != &init_net)
                return NOTIFY_DONE;
 
-       if (!dev_is_ethdev(dev) && !lapbeth_get_x25_dev(dev))
+       lapbeth = lapbeth_get_x25_dev(dev);
+       if (!dev_is_ethdev(dev) && !lapbeth)
                return NOTIFY_DONE;
 
        switch (event) {
        case NETDEV_UP:
                /* New ethernet device -> new LAPB interface     */
-               if (!lapbeth_get_x25_dev(dev))
+               if (!lapbeth)
                        lapbeth_new_device(dev);
                break;
        case NETDEV_GOING_DOWN:
                /* ethernet device closes -> close LAPB interface */
-               lapbeth = lapbeth_get_x25_dev(dev);
                if (lapbeth)
                        dev_close(lapbeth->axdev);
                break;
        case NETDEV_UNREGISTER:
                /* ethernet device disappears -> remove LAPB interface */
-               lapbeth = lapbeth_get_x25_dev(dev);
                if (lapbeth)
                        lapbeth_free_device(lapbeth);
                break;
+       case NETDEV_PRE_TYPE_CHANGE:
+               /* Our underlying device type must not change. */
+               if (lapbeth)
+                       return NOTIFY_BAD;
        }
 
        return NOTIFY_DONE;